[SSSD] [PATCH] PROXY: Don't add alias attribute when is the same as, username

Jakub Hrozek jhrozek at redhat.com
Fri Nov 16 16:02:58 UTC 2012


On Fri, Nov 16, 2012 at 03:53:07PM +0100, Jakub Hrozek wrote:
> On Fri, Nov 16, 2012 at 02:04:57PM +0100, Ondrej Kos wrote:
> > fixes https://fedorahosted.org/sssd/ticket/1628
> > 
> > When user's alias was the same as pw_name, the sysdb search was failing.
> > This resulted into not contacting the provider again.
> 
> Ack
> 
> The name is *usually* the same as alias, we just try to canonicalize the
> result of the proxy provider. In 90% of cases, the canonicalization just
> yields the same real name as the name requested (which was passed as an
> alias).

Actually, nack. Sorry, I didn't take a deep enough look the first time
around. The issue really lies in the ghost users as I originally
thought.

This patch only fixes the symptom, not the cause. The bug can
still persist if some other part of the code stores the same string in
name and the alias. That might be weird, but it's two different
attributes, so why not and it actually *might* be happening in a
case_insensitive domain if the original name was already lowercase.

So I think the proper fix would be to change building the filter in
sysdb_add_user() to only include the alias if it differs from the
primary name -OR- only delete the aliases from the ghost attributes,
whichever would be more elegant.



More information about the sssd-devel mailing list